EIP controlled through a bug in decode_string()